BootBandit: A macOS bootloader attack

[…]In this paper, we discuss an attack that borrows concepts from the evil maid. We assume exploitation can be used to infect a bootloader on a system running macOS remotely to install code to steal the user’s password. We explore the ability to create a communication channel between the bootloader and the operating system to remotely steal the password for a disk protected by FileVault 2. On a macOS system, this attack has additional implications due to “password forwarding” technology, in which a user’s account password also serves as the FileVault password, enabling an additional attack surface through privilege escalation.[…]

https://onlinelibrary.wiley.com/doi/full/10.1002/eng2.12032